CVE-2026-47476: NVIDIA Triton Inference Server DoS Flaw

CVE-2026-47476 Overview

CVE-2026-47476 is an uncontrolled resource consumption vulnerability [CWE-400] in NVIDIA Triton Inference Server for Linux. A remote, unauthenticated attacker can send crafted network requests that force the server to consume excessive resources. Successful exploitation results in denial of service, degrading or halting inference workloads served by the affected host.

The flaw is reachable over the network without authentication or user interaction. Because Triton commonly fronts production machine learning models, an outage can cascade to dependent applications and pipelines. Organizations running Triton in exposed environments should treat this as an availability-impacting issue requiring prompt remediation.

Critical Impact
Unauthenticated remote attackers can trigger denial of service against NVIDIA Triton Inference Server, disrupting inference availability for dependent applications.

Affected Products

NVIDIA Triton Inference Server for Linux
Specific affected versions were not enumerated in the NVD record at publication
Refer to the NVIDIA security advisory for the definitive list of impacted releases

Discovery Timeline

2026-07-14 - CVE-2026-47476 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47476

Vulnerability Analysis

CVE-2026-47476 is classified as uncontrolled resource consumption [CWE-400]. NVIDIA Triton Inference Server exposes network endpoints for inference requests, model management, and metrics. The vulnerability allows an attacker to send requests that cause the server to allocate or hold resources beyond expected limits. The result is exhaustion of memory, CPU, threads, or other bounded server resources.

The impact is confined to availability. The vulnerability does not expose model data, inference inputs, or configuration secrets. It also does not permit code execution or privilege changes on the host. Denial of service against Triton, however, can halt downstream ML-driven services, including recommendation systems, computer vision pipelines, and generative AI backends.

Root Cause

The root cause is the absence of adequate limits or throttling on a resource-consuming code path within Triton's request handling. Without enforced ceilings on allocation size, request rate, or concurrent operations, an attacker can drive the server into a state where legitimate requests fail or timeout. NVIDIA has not publicly disclosed the specific subsystem at fault in the NVD entry.

Attack Vector

The attack vector is network-based with low complexity and requires no privileges or user interaction. An attacker sends crafted requests to a Triton endpoint reachable from their network position. The endpoint may be the HTTP, gRPC, or metrics interface exposed by the server. Repeated or single malformed requests cause the server to exhaust resources and stop serving legitimate traffic.

No verified proof-of-concept code has been published. Refer to the NVD entry for CVE-2026-47476 and the CVE.org record for technical updates as they become available.

Detection Methods for CVE-2026-47476

Indicators of Compromise

Sudden spikes in Triton process memory, CPU, or thread counts without corresponding legitimate traffic
Repeated HTTP or gRPC requests from a single source targeting /v2/models or inference endpoints
Triton server logs showing request timeouts, out-of-memory errors, or worker thread saturation
Downstream application errors indicating inference request failures or timeouts

Detection Strategies

Monitor Triton container and process resource metrics for anomalies against a baseline of normal inference load
Correlate ingress traffic patterns against Triton request logs to identify volumetric or malformed request bursts
Alert on repeated 5xx responses or gRPC status codes indicating server-side resource exhaustion

Monitoring Recommendations

Ingest Triton access logs, metrics, and host telemetry into a centralized analytics platform for continuous review
Establish resource utilization baselines per model and endpoint to enable anomaly detection
Track network flows to Triton endpoints and alert on unauthorized source addresses

How to Mitigate CVE-2026-47476

Immediate Actions Required

Apply the patched version of NVIDIA Triton Inference Server once available from the vendor advisory
Restrict network access to Triton endpoints so only authorized clients can reach HTTP, gRPC, and metrics interfaces
Place Triton behind a reverse proxy or API gateway that enforces authentication, rate limiting, and request size caps
Review exposure of Triton instances on public networks and remove unnecessary internet reachability

Patch Information

NVIDIA is the maintainer of Triton Inference Server. Consult the official NVIDIA security bulletins for the fixed version corresponding to CVE-2026-47476. The NVD entry will be updated with vendor advisory links as they are published.

Workarounds

Enforce request rate limits and maximum payload sizes at the ingress layer in front of Triton
Deploy resource quotas and cgroup limits on Triton containers to contain the blast radius of resource exhaustion
Segment Triton servers into isolated network zones accessible only to trusted inference clients
Enable health checks and automatic restart policies to recover service after resource exhaustion events

bash

# Example: restrict Triton exposure using iptables to a trusted subnet
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8002 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 8001 -j DROP
iptables -A INPUT -p tcp --dport 8002 -j DROP